zlacker

>>myster+(OP)
Notably Notepad++ was recently shipping unsigned/self-signed updates, apparently overlapping with the time of this incident, see releases 8.8.2-8.8.6: https://notepad-plus-plus.org/news/

>>tech23+V3
So they just conveniently decided not to sign their releases right around the time they were supposedly "hacked"?

Something doesn't seem right here.

>>bakugo+F4
Code signing certs are unfortunately expensive

>>adzm+d6
$700+ at Sectigo for two years

Something of Notepad++ size might think about it now

>>firest+58
the issue was not the money, but that it was difficult to get a certificate without having some sort of legal entity

>>hjoutf+tu
It was negligence. You don't need a certificate to prevent update tampering.